4 ms·
This is just inane. There's nothing in this piece, or in anything from the previous decade, that suggests Microsoft is intentionally putting people at risk. The
by Bayart 5y ago
This is just inane. There's nothing in this piece, or in anything from the previous decade, that suggests Microsoft is intentionally putting people at risk. The only thing I can think about is potential dealings with the NSA, but you could say as much of any large American tech company.
The fact is that Microsoft has continuously improved its process for the past fifteen years while being the most exposed company in IT.
Backwards compatibility, including keeping arcane and dangerous features, is the killer product of Microsoft and companies value it enough to accept increased risk exposure. That's all there is to it.
>The design of Active Directory, Office macros, PowerShell, and other tools has enabled successive generations of threat actors to compromise entire environments undetected.
And SSH and Bash contribute to arbitrary remote code execution !
- Spooky23 5y agoYes and no. If you don’t buy E5, Microsoft’s position is that you are not entitled to even basic things like conditional access in O365. They no longer invest, even in 1st party solutions to allow for a clean implementation of this sort of solution. They are a company with a lot of good security capability, but they use anticompetitive tactics to sell them. Products like O365 are very insecure for many customers as a result. I should not need to turn employee identity over to Azure AD to authenticate email users. Ditto with modern windows. You cannot do modern mdm management with SCCM unless you buy Intune. That was a feature offered and the withdrawn as market uptake of Intune was poor. (because it sucks.) Again, I shouldn’t need to turn over machine identity to Azure AD to image a PC.
- GordonS 5y agoThe E5 thing really annoys me, and I've seen many others in the infosec space on Twitter bemoaning it too. It really is silly that they reserve security features for E5 customers, when these things should be available to all customers.
- raxxorrax 5y agoWe have E5 licenses, which security features are you referring to?
- Spooky23 5y agoWithin O365, ATP is a E5 feature, although I’m sure the legacy AV in E3 is awesome. The ability to limit client access is very limited. Anything ActiveSync will sync. I believe the only other option is to only allow the Outlook for Mobile App. E5 allows you to limit the types of clients that can connect. M365 E5 or EMS allow for conditional access, and to terminate sessions based on various criteria. Without it, you are limited as to how you can affect application access.
- basch 5y agoI once sent this https://ibb.co/XpwGwrK https://ibb.co/XpwGwrK to Satya, but never got a response. It was absolutely a racket that you couldnt connect Windows Pro Defender to the cloud to track threats without renting Win E5. Everyone in this thread is very defensive, but putting the security features all at the top of the licensing chain is exactly the behavior the author is accusing them of. The author however wrote a puff piece that was nearly devoid of any useful information. You could have deleted the entire article and kept just: "So, with one hand, the company ships vulnerabilities and hosts malware, and with the other, it charges to “protect” users from those same vulnerabilities and threats." What the article did not do, was make a convincing argument that a third party alternative was a better threat protector. They could do a worse job while also having a lesser conflict of interest.
- ygjb 5y ago> The fact is that Microsoft has continuously improved its process for the past fifteen years while being the most exposed company in IT. It's not just that they have continuously improved process, they have also made enormous contributions to the security space in terms of building and sharing repeatable processes, and providing a platform to socialize some of those practices (for example, bug bounty programs, threat modelling, SDL practices, tons of documentation and guidance around how to improve processes). I am not a Microsoft shill - my main use for Windows and Microsoft products are video games, and Microsoft Office, but they have made tremendous progress and shared several tools and learnings along the way.
- thingification 5y ago> This is just inane. There's nothing in this piece, or in anything from the previous decade, that suggests Microsoft is intentionally putting people at risk. Are saying the article suggests that but does not support it? If so, where does it suggest that? I don't see that, scanning the article -- but I do see: > it was not the company’s intention to become a leading contributor to security risk. It seems like they're not suggesting some evil plan, but something more like just the operation of the market?